LSASS & Winsock2 Problem

RustynutsRustynuts
edited March 2007 in Science & Tech
I got the LSASS.exe error message about the service stopping and rebooting in 1-minute. Saw all the online discussion about viri/worm, but this looked to be the legit file spelled right and in the right folder. Further searching got me to a Microsoft support page that said the fix is to go into the registry and delete the references to Winsock2 in several places.

Now I can't connect to the internet at all! Tried the repair function and it failed. tried to setup a new network connection and nothing happens. One other weird thing is I was running Sygate Firewall, and now it seemed to disappear!

I've got NOD32 running and tried a full scan overnite, and it was running fine, but somehow the PC got into a sleep mode and I couldn't get it to wake up. Had to power off.

Virus/worm? Or did I just hose something deleting Winsock2? There were no other funny looking services running, but I didn't do a Hijack-This run yet.

Comments

  • RustynutsRustynuts
    edited March 2007
    I found another MS thread that says to reinstall TCP/IP after deleting Winsock2. Maybe that will help? Running XP Pro. The Firewall thing seems to be a normal thing to happen when deleting Winsock. Just have to reinstall.
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited March 2007
    http://www.short-media.com/forum/showpost.php?p=392542&postcount=4

    Ignore the IE6 part.
  • RustynutsRustynuts
    edited March 2007
    I think I recently updated that PC to IE7 through the normal windows update routine. Could that have screwed with my LSASS? I thought the XP winsock was "self healing" but you still need to do this to TCP/IP?

    The network connection I use was still "connected" but had a message saying that it was extremely slow and I would probably not be able to connect to the internet (true!).
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited March 2007
    IE7 would not have messed with LSASS.

    XP winsock is self-healing: Only if you delete Winsock and Winsock2.

    Perform both steps (Ignoring the IE section) in the link and you should have a connection back.
  • RustynutsRustynuts
    edited March 2007
    The instructions only said to delete winsock2, so I guess XP didn't try to heal itself. Will try the steps tonight to fix TCP. AFTER I scan to make sure I don't have the sasser worm!
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited March 2007
    XP winsock is self-healing: Only if you delete Winsock and Winsock2.

    http://www.short-media.com/forum/showpost.php?p=392542&postcount=4
  • RustynutsRustynuts
    edited March 2007
    Problem fixed! No sign of Sasser, so I'm not sure what caused the initial LSASS problem. Winsock took a few tries, reinstalling TCP/IP, deleting registry keys, repeating. Finally I think a combo of that plus using the NETSH /renew command worked.
Sign In or Register to comment.